Vulnerabilities > CVE-2017-15131
Attack vector
LOCAL Attack complexity
LOW Privileges required
LOW Confidentiality impact
HIGH Integrity impact
HIGH Availability impact
HIGH Summary
It was found that system umask policy is not being honored when creating XDG user directories, since Xsession sources xdg-user-dirs.sh before setting umask policy. This only affects xdg-user-dirs before 0.15.5 as shipped with Red Hat Enterprise Linux.
Vulnerable Configurations
Nessus
NASL family NewStart CGSL Local Security Checks NASL id NEWSTART_CGSL_NS-SA-2019-0026_XDG-USER-DIRS.NASL description The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has xdg-user-dirs packages installed that are affected by a vulnerability: - It was found that the system umask policy is not being honored when creating XDG user directories (~/Desktop etc) on first login. This could lead to user last seen 2020-06-01 modified 2020-06-02 plugin id 127188 published 2019-08-12 reporter This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/127188 title NewStart CGSL CORE 5.04 / MAIN 5.04 : xdg-user-dirs Vulnerability (NS-SA-2019-0026) NASL family Huawei Local Security Checks NASL id EULEROS_SA-2018-1024.NASL description According to the version of the xdg-user-dirs package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - It was found that the system umask policy is not being honored when creating XDG user directories (~/Desktop etc) on first login. This could lead to user last seen 2020-05-06 modified 2018-01-19 plugin id 106165 published 2018-01-19 reporter This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/106165 title EulerOS 2.0 SP1 : xdg-user-dirs (EulerOS-SA-2018-1024) NASL family Amazon Linux Local Security Checks NASL id AL2_ALAS-2018-1030.NASL description It was found that the system umask policy is not being honored when creating XDG user directories (~/Desktop etc) on first login. This could lead to user last seen 2020-06-01 modified 2020-06-02 plugin id 110447 published 2018-06-12 reporter This script is Copyright (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/110447 title Amazon Linux 2 : xdg-user-dirs (ALAS-2018-1030) NASL family Scientific Linux Local Security Checks NASL id SL_20180410_XDG_USER_DIRS_ON_SL7_X.NASL description Security Fix(es) : - xdg-user-dirs, gnome-session: Xsession creation of XDG user directories does not honor system umask policy (CVE-2017-15131) Additional Changes : last seen 2020-03-18 modified 2018-05-01 plugin id 109459 published 2018-05-01 reporter This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/109459 title Scientific Linux Security Update : xdg-user-dirs on SL7.x x86_64 (20180410) NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2018-0842.NASL description From Red Hat Security Advisory 2018:0842 : An update for xdg-user-dirs is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link (s) in the References section. xdg-user-dirs is a tool to create and configure default desktop user directories such as the Music and the Desktop directories. Security Fix(es) : * xdg-user-dirs, gnome-session: Xsession creation of XDG user directories does not honor system umask policy (CVE-2017-15131) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes : For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.5 Release Notes linked from the References section. last seen 2020-06-01 modified 2020-06-02 plugin id 109107 published 2018-04-18 reporter This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/109107 title Oracle Linux 7 : xdg-user-dirs (ELSA-2018-0842) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2018-0842.NASL description An update for xdg-user-dirs is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link (s) in the References section. xdg-user-dirs is a tool to create and configure default desktop user directories such as the Music and the Desktop directories. Security Fix(es) : * xdg-user-dirs, gnome-session: Xsession creation of XDG user directories does not honor system umask policy (CVE-2017-15131) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes : For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.5 Release Notes linked from the References section. last seen 2020-06-01 modified 2020-06-02 plugin id 108987 published 2018-04-11 reporter This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/108987 title RHEL 7 : xdg-user-dirs (RHSA-2018:0842) NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2018-0842.NASL description An update for xdg-user-dirs is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link (s) in the References section. xdg-user-dirs is a tool to create and configure default desktop user directories such as the Music and the Desktop directories. Security Fix(es) : * xdg-user-dirs, gnome-session: Xsession creation of XDG user directories does not honor system umask policy (CVE-2017-15131) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes : For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.5 Release Notes linked from the References section. last seen 2020-06-01 modified 2020-06-02 plugin id 109373 published 2018-04-27 reporter This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/109373 title CentOS 7 : xdg-user-dirs (CESA-2018:0842) NASL family Huawei Local Security Checks NASL id EULEROS_SA-2018-1025.NASL description According to the version of the xdg-user-dirs package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - It was found that the system umask policy is not being honored when creating XDG user directories (~/Desktop etc) on first login. This could lead to user last seen 2020-05-06 modified 2018-01-19 plugin id 106166 published 2018-01-19 reporter This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/106166 title EulerOS 2.0 SP2 : xdg-user-dirs (EulerOS-SA-2018-1025) NASL family Huawei Local Security Checks NASL id EULEROS_SA-2018-1181.NASL description According to the version of the xdg-user-dirs package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - It was found that the system umask policy is not being honored when creating XDG user directories (~/Desktop etc) on first login. This could lead to user last seen 2020-05-06 modified 2018-07-03 plugin id 110845 published 2018-07-03 reporter This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/110845 title EulerOS 2.0 SP3 : xdg-user-dirs (EulerOS-SA-2018-1181)
Redhat
| advisories |
| ||||||||||||||||||||||||||||||||||||||
| rpms |
|
References
- https://access.redhat.com/errata/RHSA-2018:0842
- https://access.redhat.com/errata/RHSA-2018:0842
- https://bugzilla.redhat.com/show_bug.cgi?id=1412762
- https://bugzilla.redhat.com/show_bug.cgi?id=1412762
- https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E
- https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E